Business Environment Task 5 (Plan and manage risk, including poor IT security) treats an un-realized threat as a risk to be registered, analyzed, and responded to proactively. Recognizing when a risk becomes an issue (Task 4) matters, but this is still a risk. Logging it as an issue or accepting it forfeits the chance to prevent a breach.